Self-incrimination—Privilege against selfincrimination— Refusal to disclose means of access to protected data

Court of Appeal, Criminal Division, Sir Igor Judge P, Mr Justice Penry-Davey and Mr Justice Simon, 9 Oct 2008

A requirement under the Regulation of Investigatory Powers Act 2000 (RIPA 2000) to disclose a key to encrypted computer information already in the possession of the Crown may not be opposed on the ground of the privilege against self-incrimination.

Matthew Ryder and Steven Powles (assigned by the Registrar of Criminal Appeals) for S. Nick Wrack (assigned by the Registrar of Criminal Appeals) for A, Nigel Godsmark QC and Louis Mably for the Crown.

During 2007, H was made the subject of a control order under the Prevention of Terrorism Act 2005. H subsequently absconded, allegedly with the assistance of the defendants to the instant proceedings. H was later arrested, and various computer files were seized from him and from the defendants. However, without encryption keys the files could not be accessed. The defendants were charged with conspiracy to breach the control order imposed on H.

In early 2008, notices under s 53 of RIPA 2000 were served on the defendants. The notices set out the requirement for the disclosure of “a key or any supporting information to make information intelligible”. Neither defendant complied with the notices, which led to charges being brought and a further two counts being added to the indictment. The defendants made an application for those counts to be stayed.

The application was rejected and the defendants appealed. They submitted that the requirement to provide information to the police under RIPA 2000, Pt III constituted an impermissible infringement of the privilege against self-incrimination, and contravened their rights under Art 6 of the European Convention on Human Rights (the Convention). They further contended that any protection which s 78 of the Police and Criminal Evidence Act 1984 (PACE) might be found to afford could only arise for consideration at trial, after the defendants would have been forced to incriminate themselves.

Sir Igor Judge P:
The privilege against self-incrimination was deeply rooted in the common law. Art 6 of the Convention encompassed the same protection against selfincrimination. It was well understood that the principle was subject to numerous statutory exceptions which limited, amended, or abrogated the privilege in specified circumstances. Thus, despite the privilege, individuals might sometimes be required to answer questions or provide information or documents which might incriminate them. In those circumstances it was not submitted that the privilege against self incrimination was absolute, nor that the offence created in the context of RIPA 2000, Pt III was incompatible with Art 6 of the Convention.

The principle that evidence existing independent of the will of the subject did not normally engage the privilege against self-incrimination was clearly established in domestic law. It was applied in Attorney-General’s Reference (No 7 of 2000) [2001] 2 Cr App 286. The debate in argument thus concentrated on the rival contentions whether the key to each defendant’s protected data was properly to be catalogued as a piece of information with an existence separate from his “will”.

On analysis, the key which provided access to protected data, like the data itself, existed separately from each appellant’s will. Even if it was true that each created his own key, once created, the key to the data, remained independent of the defendant’s will even when it was retained only in his memory, at any rate until it was changed. If investigating officers were able to identify the key from a different source no one would argue that the key was not distinct from the equipment which was to be accessed, and indeed the individual who owned the equipment and knew the key to it. Again, if the arresting officers had arrived at the premises immediately after a defendant had completed the process of accessing his own equipment enabling them to identify the key, the key itself would have been a piece of information existing, at that point, independently of the defendant himself and would have been immediately available to the police for their use in the investigation. In that sense the key to the computer equipment was no different to the key to a locked drawer. The contents might or might not be incriminating: the key was neutral. In the instant case the prosecution was in possession of the drawer: it could not, however, gain access to the contents.

Incriminatory material
The correct analysis was that the privilege against self-incrimination might be engaged by a requirement of disclosure of knowledge of the means of access to protected data under compulsion of law. In short, although the defendants’ knowledge of the means of access to the data might engage the privilege against self-incrimination, it would only do so if the data itself—which undoubtedly existed independently of the will of the defendants and to which the privilege against self-incrimination did not apply— contained incriminating material.

If that data was neutral or innocent, the knowledge of the means of access to it would similarly be either neutral or innocent. On the other hand, if the material were incriminatory, it would be open to the trial judge to exclude evidence of the means by which the prosecution gained access to it. Accordingly the extent to which the privilege against self-incrimination might be engaged was indeed very limited.

The question which arose, if the privilege was engaged at all, was whether or not the interference with it was proportionate and permissible. The material which really mattered was lawfully in the hands of the police. Without the key it was unreadable. That was all. The process of making it readable should not alter it other than putting it into an unencrypted and intelligible form that it was in prior to encryption; the material in the possession of the police would simply be revealed for what it was.

The appeals would therefore be dismissed.